From 239db054a731a8e35ab239a025219a16bba2deb3 Mon Sep 17 00:00:00 2001 From: David Thompson Date: Mon, 8 Jun 2015 08:59:00 -0400 Subject: gnu: system: Add Linux container module. * gnu/system/linux-container.scm: New file. * gnu-system.am (GNU_SYSTEM_MODULES): Add it. * gnu/system.scm: Export 'operating-system-etc-directory', 'operating-system-boot-script', 'operating-system-locale-directory', and 'file-union'. (operating-system-boot-script): Add #:container? keyword argument. (operating-system-activation-script): Add #:container? keyword argument. Don't call 'activate-firmware' or 'activate-ptrace-attach' when activating a container. --- gnu/system/linux-container.scm | 119 +++++++++++++++++++++++++++++++++++++++++ 1 file changed, 119 insertions(+) create mode 100644 gnu/system/linux-container.scm (limited to 'gnu/system') diff --git a/gnu/system/linux-container.scm b/gnu/system/linux-container.scm new file mode 100644 index 0000000000..fdf7460872 --- /dev/null +++ b/gnu/system/linux-container.scm @@ -0,0 +1,119 @@ +;;; GNU Guix --- Functional package management for GNU +;;; Copyright © 2015 David Thompson +;;; +;;; This file is part of GNU Guix. +;;; +;;; GNU Guix is free software; you can redistribute it and/or modify it +;;; under the terms of the GNU General Public License as published by +;;; the Free Software Foundation; either version 3 of the License, or (at +;;; your option) any later version. +;;; +;;; GNU Guix is distributed in the hope that it will be useful, but +;;; WITHOUT ANY WARRANTY; without even the implied warranty of +;;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +;;; GNU General Public License for more details. +;;; +;;; You should have received a copy of the GNU General Public License +;;; along with GNU Guix. If not, see . + +(define-module (gnu system linux-container) + #:use-module (ice-9 match) + #:use-module (srfi srfi-1) + #:use-module (guix config) + #:use-module (guix store) + #:use-module (guix gexp) + #:use-module (guix derivations) + #:use-module (guix monads) + #:use-module (gnu build linux-container) + #:use-module (gnu system) + #:use-module (gnu system file-systems) + #:export (mapping->file-system + system-container + containerized-operating-system + container-script)) + +(define (mapping->file-system mapping) + "Return a file system that realizes MAPPING." + (match mapping + (($ source target writable?) + (file-system + (mount-point target) + (device source) + (type "none") + (flags (if writable? + '(bind-mount) + '(bind-mount read-only))) + (check? #f) + (create-mount-point? #t))))) + +(define (system-container os) + "Return a derivation that builds OS as a Linux container." + (mlet* %store-monad + ((profile (operating-system-profile os)) + (etc (operating-system-etc-directory os)) + (boot (operating-system-boot-script os #:container? #t)) + (locale (operating-system-locale-directory os))) + (file-union "system-container" + `(("boot" ,#~#$boot) + ("profile" ,#~#$profile) + ("locale" ,#~#$locale) + ("etc" ,#~#$etc))))) + +(define (containerized-operating-system os mappings) + "Return an operating system based on OS for use in a Linux container +environment. MAPPINGS is a list of to realize in the +containerized OS." + (define user-file-systems + (remove (lambda (fs) + (let ((target (file-system-mount-point fs)) + (source (file-system-device fs))) + (or (string=? target (%store-prefix)) + (string=? target "/") + (string-prefix? "/dev/" source) + (string-prefix? "/dev" target) + (string-prefix? "/sys" target)))) + (operating-system-file-systems os))) + + (define (mapping->fs fs) + (file-system (inherit (mapping->file-system fs)) + (needed-for-boot? #t))) + + (operating-system (inherit os) + (swap-devices '()) ; disable swap + (file-systems (append (map mapping->fs (cons %store-mapping mappings)) + %container-file-systems + user-file-systems)))) + +(define* (container-script os #:key (mappings '())) + "Return a derivation of a script that runs OS as a Linux container. +MAPPINGS is a list of objects that specify the files/directories +that will be shared with the host system." + (let* ((os (containerized-operating-system os mappings)) + (file-systems (filter file-system-needed-for-boot? + (operating-system-file-systems os))) + (specs (map file-system->spec file-systems))) + + (mlet* %store-monad ((os-drv (system-container os))) + + (define script + #~(begin + (use-modules (gnu build linux-container) + (guix build utils)) + + (call-with-container '#$specs + (lambda () + (setenv "HOME" "/root") + (setenv "TMPDIR" "/tmp") + (setenv "GUIX_NEW_SYSTEM" #$os-drv) + (for-each mkdir-p '("/run" "/bin" "/etc" "/home" "/var")) + (primitive-load (string-append #$os-drv "/boot")))))) + + (gexp->script "run-container" script + #:modules '((ice-9 match) + (srfi srfi-98) + (guix config) + (guix utils) + (guix build utils) + (guix build syscalls) + (gnu build file-systems) + (gnu build linux-container)))))) -- cgit v1.2.3 From cc0e575a94a4e22a0bf2bf1b0c7b0514f1c1fbb5 Mon Sep 17 00:00:00 2001 From: Ludovic Courtès Date: Sun, 20 Sep 2015 21:44:39 +0200 Subject: linux-boot: Mount /dev as a devtmpfs from the start. Suggested by Petter and Mark H Weaver . Reported by Duncan Keall . Partly fixes by populating /dev/mapper early enough. * gnu/build/linux-boot.scm (mount-essential-file-systems): Mount /dev as a devtmpfs. (move-essential-file-systems): Add /dev. (mount-root-file-system): Mount /rw-root/dev as a devtmpfs instead of calling 'make-essential-device-nodes'. (boot-system): Remove call to 'make-essential-device-nodes'. * gnu/system/file-systems.scm (%devtmpfs-file-system): Remove. * doc/guix.texi (File Systems): Adjust accordingly. --- doc/guix.texi | 7 +------ gnu/build/linux-boot.scm | 20 +++++++++----------- gnu/system/file-systems.scm | 15 +-------------- 3 files changed, 11 insertions(+), 31 deletions(-) (limited to 'gnu/system') diff --git a/doc/guix.texi b/doc/guix.texi index cfe83909da..3ca4cefa63 100644 --- a/doc/guix.texi +++ b/doc/guix.texi @@ -5295,16 +5295,11 @@ variables. @defvr {Scheme Variable} %base-file-systems These are essential file systems that are required on normal systems, -such as @var{%devtmpfs-file-system} and @var{%immutable-store} (see +such as @var{%pseudo-terminal-file-system} and @var{%immutable-store} (see below.) Operating system declarations should always contain at least these. @end defvr -@defvr {Scheme Variable} %devtmpfs-file-system -The @code{devtmpfs} file system to be mounted on @file{/dev}. This is a -requirement for udev (@pxref{Base Services, @code{udev-service}}). -@end defvr - @defvr {Scheme Variable} %pseudo-terminal-file-system This is the file system to be mounted as @file{/dev/pts}. It supports @dfn{pseudo-terminals} created @i{via} @code{openpty} and similar diff --git a/gnu/build/linux-boot.scm b/gnu/build/linux-boot.scm index 3081a93a97..30d6570b04 100644 --- a/gnu/build/linux-boot.scm +++ b/gnu/build/linux-boot.scm @@ -48,7 +48,7 @@ (define-module (gnu build linux-boot) ;;; Code: (define* (mount-essential-file-systems #:key (root "/")) - "Mount /proc and /sys under ROOT." + "Mount /dev, /proc, and /sys under ROOT." (define (scope dir) (string-append root (if (string-suffix? "/" root) @@ -60,6 +60,10 @@ (define (scope dir) (mkdir (scope "proc"))) (mount "none" (scope "proc") "proc") + (unless (file-exists? (scope "dev")) + (mkdir (scope "dev"))) + (mount "none" (scope "dev") "devtmpfs") + (unless (file-exists? (scope "sys")) (mkdir (scope "sys"))) (mount "none" (scope "sys") "sysfs")) @@ -71,7 +75,7 @@ (define (move-essential-file-systems root) (unless (file-exists? target) (mkdir target)) (mount dir target "" MS_MOVE))) - '("/proc" "/sys"))) + '("/dev" "/proc" "/sys"))) (define (linux-command-line) "Return the Linux kernel command line as a list of strings." @@ -100,7 +104,7 @@ (define* (make-disk-device-nodes base major #:optional (minor 0)) (define* (make-essential-device-nodes #:key (root "/")) "Make essential device nodes under ROOT/dev." - ;; The hand-made udev! + ;; The hand-made devtmpfs/udev! (define (scope dir) (string-append root @@ -255,7 +259,8 @@ (define (mark-as-not-killable pid) (mount "none" "/rw-root" "tmpfs") ;; We want read-write /dev nodes. - (make-essential-device-nodes #:root "/rw-root") + (mkdir-p "/rw-root/dev") + (mount "none" "/rw-root/dev" "devtmpfs") ;; Make /root a union of the tmpfs and the actual root. Use ;; 'max_files' to set a high RLIMIT_NOFILE for the unionfs process @@ -385,9 +390,6 @@ (define (lookup-module name) (unless (configure-qemu-networking) (display "network interface is DOWN\n"))) - ;; Make /dev nodes. - (make-essential-device-nodes) - ;; Prepare the real root file system under /root. (unless (file-exists? "/root") (mkdir "/root")) @@ -405,10 +407,6 @@ (define (lookup-module name) #:volatile-root? volatile-root?) (mount "none" "/root" "tmpfs")) - (unless (file-exists? "/root/dev") - (mkdir "/root/dev") - (make-essential-device-nodes #:root "/root")) - ;; Mount the specified file systems. (for-each mount-file-system (remove root-mount-point? mounts)) diff --git a/gnu/system/file-systems.scm b/gnu/system/file-systems.scm index b177f93398..8155b273e3 100644 --- a/gnu/system/file-systems.scm +++ b/gnu/system/file-systems.scm @@ -47,7 +47,6 @@ (define-module (gnu system file-systems) %binary-format-file-system %shared-memory-file-system %pseudo-terminal-file-system - %devtmpfs-file-system %immutable-store %control-groups %elogind-file-systems @@ -186,17 +185,6 @@ (define %binary-format-file-system (type "binfmt_misc") (check? #f))) -(define %devtmpfs-file-system - ;; /dev as a 'devtmpfs' file system, needed for udev. - (file-system - (device "none") - (mount-point "/dev") - (type "devtmpfs") - (check? #f) - - ;; Mount it from the initrd so /dev/pts & co. can then be mounted over it. - (needed-for-boot? #t))) - (define %tty-gid ;; ID of the 'tty' group. Allocate it statically to make it easy to refer ;; to it from here and from the 'tty' group definitions. @@ -282,8 +270,7 @@ (define %elogind-file-systems (define %base-file-systems ;; List of basic file systems to be mounted. Note that /proc and /sys are ;; currently mounted by the initrd. - (append (list %devtmpfs-file-system - %pseudo-terminal-file-system + (append (list %pseudo-terminal-file-system %shared-memory-file-system %immutable-store) %elogind-file-systems -- cgit v1.2.3 From 07779d0addd5bc52d0bc2e06054a158c5c6abb4b Mon Sep 17 00:00:00 2001 From: Ludovic Courtès Date: Sun, 20 Sep 2015 22:02:02 +0200 Subject: linux-initrd: Add LUKS/dm-crypt modules to the initrd. Suggested by Petter and Mark H Weaver . Partly fixes . * gnu/system/linux-initrd.scm (base-initrd)[linux-modules]: Add dm-crypt and xts. --- gnu/system/linux-initrd.scm | 1 + 1 file changed, 1 insertion(+) (limited to 'gnu/system') diff --git a/gnu/system/linux-initrd.scm b/gnu/system/linux-initrd.scm index 48b855b567..519373fe34 100644 --- a/gnu/system/linux-initrd.scm +++ b/gnu/system/linux-initrd.scm @@ -182,6 +182,7 @@ (define linux-modules "isci" ;for SAS controllers like Intel C602 "usb-storage" "uas" ;for the installation image etc. "usbkbd" "usbhid" ;USB keyboards, for debugging + "dm-crypt" "xts" ;for encrypted root partitions ,@(if (or virtio? qemu-networking?) virtio-modules '()) -- cgit v1.2.3